United Arab Emirates AE

The UAE's sanctions exposure this cycle is dominated by unilateral US secondary-sanctions activity rather than any domestic UAE sanctions action. On 24 August 2026 the US Office of Foreign Assets Control found that Banque Misr's five UAE branches presented a primary money laundering concern under Section 311 of the USA PATRIOT Act, a special-measures finding that bars those branches from maintaining US correspondent-account access. OFAC followed this on 4 September 2026 with the designation of Turkiye-based Golden Global Bank, a measure framed as targeting facilitation of Iran's access to international banking channels, a designation with UAE-linked correspondent exposure given the Gulf's role as a transit point for Iran-adjacent trade and banking flows. These two actions sit within what has been characterised as Operation Economic Outcast, a sustained US campaign of secondary-sanctions pressure on banking and trade intermediaries alleged to facilitate Iran sanctions evasion. The structural point is that this pressure is applied externally and unilaterally: no corresponding UAE domestic enforcement or regulatory action against the same institutions or conduct was identified this cycle, meaning the sanctions-architecture signal here is a divergence signal, US sanctions reach extending into UAE-domiciled banking relationships, rather than a convergence signal.

Alongside this external pressure, the UAE's own domestic counter-terrorist-financing screening architecture continues to operate on its separate track. UAE Cabinet Resolution No. 63 of 2026 added 16 individuals and 5 entities to the UAE Terrorist List, a designation action sourced to the UAE Executive Office for Control and Non-Proliferation, itself a Tier 1 government source. This is domestic implementation of UN Security Council-linked terrorist-financing screening obligations, structurally distinct from the Banque Misr and Golden Global Bank actions, which are US Treasury measures with no UN Security Council predicate identified in the sourcing reviewed. Reading the two tracks together, the sanctions architecture bearing on the UAE in this cycle is best understood as a two-track structure: a domestic designation regime that continues to function routinely, and an external, intensifying US secondary-sanctions track targeting UAE-linked correspondent banking exposure to Iran, with the second track showing no sign of UAE-side convergence or reciprocal domestic action this cycle.

The enablement-as-signal principle is directly relevant here. The absence of any identified UAE regulatory or enforcement response to the Banque Misr and Golden Global Bank findings, at least within the sourcing reviewed this cycle, is itself an analytically significant data point. It does not establish UAE non-compliance with its own sanctions obligations, since the US Section 311 finding is a US regulatory conclusion about correspondent-banking risk rather than a UAE sanctions violation finding, but it does mean that the correspondent-banking relationships of the affected branches now carry elevated de-risking and access-constraint pressure that originates entirely outside the UAE's own regulatory perimeter. The sanctions-regime divergence here is not a dispute about underlying facts, it reflects different competent authorities applying different legal frameworks to overlapping fact patterns, UAE-domiciled banking relationships with Iran-exposed counterparties, and reaching different conclusions about what action is warranted.

Outlook

The trajectory of US secondary-sanctions activity under Operation Economic Outcast shows no sign of deceleration, and further Section 311 or OFAC designation actions reaching UAE-linked correspondent banking relationships tied to Iran-sanctions evasion exposure remain a live possibility going into the final quarter of 2026. Whether any UAE-side regulatory response, beyond the FIU's existing general preventive-measures powers under Federal Decree-Law No. 10 of 2025, materialises in response to this specific pattern of US findings is a key open question for the next reporting cycle. Separately, the UAE's anticipated FATF 5th Round mutual evaluation, expected in the second half of 2026, will test the effectiveness of UAE's sanctions-screening and preventive-measures architecture more broadly, including the terrorist-list designation mechanism under which Cabinet Resolution No. 63 of 2026 was issued, and may surface findings relevant to how the UAE's domestic sanctions architecture interacts with the external pressure described above.

The UAE's AML/CFT/CPF regime rests on Federal Decree-Law No. 10 of 2025, in force since 14 October 2025, which repealed the prior Federal Decree-Law No. 20 of 2018 and consolidated the UAE's primary anti-money-laundering, counter-terrorist-financing and counter-proliferation-financing statute into a single federal framework covering financial institutions, Designated Non-Financial Businesses and Professions, and virtual asset service providers. Under this framework, the Financial Intelligence Unit holds a power to order cessation of suspicious activity for up to 10 working days and to freeze related assets for up to 30 days pending referral to the competent authority. This architecture sits alongside Cabinet Resolution No. 134 of 2025, which together form the current operative basis for AML/CFT preventive measures across the UAE's financial and DNFBP sectors. The confidence assessment on the statute's core provisions is Probable rather than Confirmed: the sourcing reviewed this cycle corroborates the law's content across multiple independent legal-commentary sources, but no direct UAE Official Gazette text was retrieved, which caps the assessment until primary-source retrieval occurs.

Enforcement activity under this framework continues at pace. The Central Bank of the UAE fined a foreign bank branch AED 20 million and personally fined its Head of Compliance and Money Laundering Reporting Officer AED 300,000, in a decision dated 24 June 2026, for repeated and significant failures across the branch's AML, CFT and sanctions-compliance frameworks. The personal-liability dimension of this action is notable in its own right: it reflects a UAE supervisory posture, also visible in commentary on the 2025 AML law's senior-management liability provisions, that extends compliance accountability to the individual officer holding the MLRO function, not solely to the institution. CBUAE's public reporting did not name the branch, which limits the ability to assess whether this is an isolated case or part of a pattern of enforcement against a particular category of foreign bank branch operating in the UAE.

The UAE's standing relative to the FATF grey list remains unchanged this cycle: the UAE exited the list in February 2024 and was not relisted at FATF's June 2026 plenary, which instead added Iraq and Bosnia and Herzegovina and removed Algeria and Namibia, bringing the list to 22 jurisdictions. While this produces no direct change to the UAE's own listing status, it has two indirect implications for the UAE's AML/CTF regime in practice: first, UAE obliged entities conducting enhanced due diligence and enterprise-wide risk assessments on counterparties linked to newly listed or delisted jurisdictions must refresh those country-risk inputs; and second, the UAE's own 5th Round mutual evaluation, anticipated later in 2026, will assess the effectiveness of the post-2024 reform architecture against the FATF's effectiveness-focused methodology, not merely its statutory existence. Sector commentary reviewed this cycle specifically flags DNFBP customer due diligence quality and suspicious transaction report filing rates as a historically weak area likely to receive renewed scrutiny under that methodology, a three-pillar balance point worth surfacing given that enforcement volume to date has concentrated on the banking sector rather than DNFBPs.

The virtual-asset dimension of the AML/CFT regime remains anchored in VARA's Travel Rule circular of 24 February 2026, which requires Dubai-licensed virtual asset service providers to collect full originator and beneficiary data for transfers above AED 3,500, retain records for 8 years, and refresh counterparty risk ratings on a 3-month cycle. No change to this standard was identified this cycle, and it continues to function as the operative AML/CFT layer for VASP activity alongside the broader Federal Decree-Law No. 10 of 2025 perimeter.

Outlook

The single most consequential near-term event for the UAE's AML/CTF regime is the FATF 5th Round mutual evaluation, expected in the second half of 2026, which will test whether the Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 architecture, built substantially in response to the 2022 to 2024 grey-listing episode, produces durable effectiveness outcomes rather than statutory completeness alone. DNFBP-sector due diligence and reporting quality is the area flagged as most likely to draw scrutiny. Separately, continued CBUAE enforcement activity against foreign bank branches, including personal MLRO liability, suggests supervisory intensity in the banking sector is being sustained rather than easing following the 2024 grey-list exit, a pattern worth monitoring for whether it extends into the DNFBP sector ahead of the mutual evaluation.